Refer to the exhibit. A security engineer needs to improve security in an organization and is preparing a risk-mitigation strategy to present to management for approval. Which action must the security engineer take based on this Attacks Risk Report?